WHAT IS CLAIMED IS: 



1. A method of detecting denial of service (DoS) 
attacks in an internet accessible network having at least 
one proxy server incorporating a session initiation 
protocol (SIP), comprising detecting any substantial 
imbalance between an accounting of SIP INVITE (INV) and SIP 
180 (Niao) and providing an indication of the presence of a 
current DoS attack on said proxy server. 

2 . The method of detecting denial of service attacks 
in an internet accessible network as defined in claim 1 
wherein the number (H) of INVITE messages including 
credentials (INV^) that are sent from a user client in 
response to an authentication required (407) message from 
the proxy server are removed from the accounting before the 
balance is tested such that the equation: 

INVo to + INV^ - H = Ni8o 
is not true within a small margin of error then the 
presence of a denial of service attack on the proxy server 
is indicated by the inequality. 

3 . The method of detecting denial of service attacks 
in an internet accessible network as defined in claim 2 
including causing said proxy server to maintain a call 
information table for determining the value of H. 



4 . The method of detecting denial of service attacks 
in an internet accessible network having at least one proxy 
server as defined in claim 2 wherein the values of H, INVq, 
INVc and Njgo are reset after denial of service attacks has 
been detected. 

5, A system for detecting denial of service attacks 
against session initiation protocol elements in a internet 
accessible network having at least one proxy server, 
comprising means at said proxy server for determining if 
the number of INVITE messages including credentials (INV^,) 
sent to said proxy server from user clients in response to 
an authentication requirement and providing an indication 
of a DoS attack when the number of INVITE messages exceeds 
a predetermined level. 

6. A system for detecting denial of service attacks 
in an internet accessible network having at least one proxy 
server incorporating session initiation protocol (SIP), 
comprising said proxy server including means for detecting 
any substantial imbalance between an accounting of SIP 
INVITE (INV) and SIP 180 Ringing and means providing 
indication of the presence of a current denial of service 
attack on said proxy server. 
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